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SUMMARY 


A moving-base simulation was conducted to investigate a pilot’s ability to recover from 
transients following single-axis hard-over failures of the flight-control system. The investi- 
gation was performed in conjunction with a host simulation that examined the influence of 
control modes on a single pilot’s ability to perform various mission elements under high- 
workload conditions. The NASA Ames large-amplitude- motion Vertical Motion Simulator 
(VMS) was utilized, and the experimental variables were the failure axis, the severity of the 
failure, and the airspeed at which the failure occurred. Other factors, such as pilot workload 
and terrain and obstacle proximity at the time of failure, were kept as constant as possible 
within the framework of the host simulation task scenarios. No explicit failure warnings were 
presented to the pilot. Data from the experiment are shown, and pilot ratings are compared 
with the proposed handling-qualities requirements for military rotorcraft. Results indicate 
that the current proposed failure transient requirements may need revision. 


INTRODUCTION 


The ability of the pilot to recover from the transient motion which follows many types of 
failures is of paramount importance to aircraft manufacturers and operators, both civil and 
military. For manufacturers, provision for adequate recovery capability may be a determining 
factor when designing control power and control authority into a new helicopter, and for 
operators, it may dictate new training procedures and monitoring equipment. The proposed 
update to MIL-H-8501, the Handling Qualities Requirements for Military Rotorcraft (ref. 1 ), 
outlines requirements for the capability to recover from varying levels of transients following 
failures (table 1 ). These requirements were hypothesized, however, and insufficient flight-test 
and simulation data existed to verify their applicability. Therefore, the simulation discussed 
in this report was designed to validate or update the proposed requirements. 

The investigation was carried out as part of a host simulation that was designed to 
investigate the ability of a single pilot to conduct demanding tactical mission tasks with 
different control modes under high workload conditions (ref. 2). The high level of pilot 
workload designed into the host experiment was important , since it provided sufficiently for 
pilot preoccupation with the flight task to prevent anticipation of the failures. 

Using table 1 as a guide, failure levels were defined as uncommanded attitude excursions 
in specified intervals of time or as step changes in acceleration. Single-axis hard-over failures 
in the automatic flight control system (AFCS) of the advanced digital optical control system 
(ADOCS) (ref. 3) were used to achieve the excursions. As a result, the pilots were left 
with the primary flight control system (PFCS), which utilizes only forward-loop shaping 
of the controls, for recovery in the failed axis. A step input replaced the output of the 
AFCS, and the size of this step determined the severity of the failure. To allow’ the pilot to 
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assess quantitatively the effects of the simulated failures, a failure rating scale was designed 
to complement the Cooper-Harper Pilot Rating scale (ref. 4). This report describes the 
experiment, presents the results, and makes suggestions for further investigations. 


BACKGROUND 

Previous attempts at defining specifications for transients following failures provided 
qualitative common sense approaches to the problem without specifying quantitative crite- 
ria. Chalk et al. (ref. 5) specify the following for transients following failures of the flight 
control system (FC'S): “Failure-induced transient motions and trim changes resulting either 
immediately after failure or upon subsequent transfer to alternate control modes shall be 
small and gradual enough that dangerous flying qualities never result.” Regarding single 
failures of any component or system, reference 5 states, “The aircraft motions following sud- 
den aircraft system or component failures which might occur during maneuvering flight or 
unattended trimmed flight shall be such that dangerous conditions can be avoided by pilot 
corrective action. A realistic time delay between the failure and initiation of pilot corrective 
action shall be incorporated when determining compliance.” The proposed revision to this 
document (ref. 6) retains these criteria. 

The first of the statements from references 5 and 6 just given is taken from MIL-F- 
8785B (ref. 7). A small but important change was made to MIL-F-8785B in its update 
to MIL-F-8785C (ref. 8). This change deliberately deletes the phrase “small and gradual 
enough” since it was noted that it may be to the pilot’s benefit to experience a noticeable 
transient after the failure in order to alert him or her to a failure. In fact, the experience 
of General Dynamics with the B-58 (ref. 9) led them to suggest that a minimum allowable 
transient be specified. Their reasoning was that the previously low allowable transients of 
reference 7, that would result from soft failures could lead to a catastrophe if the pilot did 
not detect the failure. For MIL-F-87850 it was decided to change only the previously noted 
wording without quantitatively specifying a minimum allowable transient following failure. 
The proposed MIL-F-83300 revision of reference 6 did not reflect this change. 

The quantitative requirements for transients following failures of MIL-F-8785C are: 
“With controls free, the airplane motions due to failures shall not exceed the following 
limits for at least 2 sec following the failure, as a function of the Level of flying qualities 
after the failure transient has subsided: 1) For Levels 1 and 2, a ±.5g incremental normal or 
lateral acceleration at the pilot’s station and ±10° per sec roll rate, except that neither stall 
angle of attack nor structural limits shall be exceeded. In addition, for Category A (flight 
that requires rapid maneuvering, precision tracking, or precise flight-path control), vertical 
or lateral excursions of 5 ft and ±2 deg. bank angle. 2) For Level 3, no dangerous attitude 
or structural limit is reached, and no dangerous alteration of the flight-path results from 
which recovery is impossible.” 


I 


2 



The proposed criteria in reference 1 stem from previous specifications for the in-flight 
and ground handling qualities of the UH-60A (ref. 10) and the AH-64A helicopters (ref. 11). 
Both of these specifications place angular rate and translational acceleration limits on the 
helicopter transient response to a failure. Reference 10 states that “with the automatic 
stabilization and stability augmentation equipment engaged, and from steady level flight for 
a period greater than 30 sec, out-of-trim conditions resulting from abrupt disengagement or 
from abrupt single failure of the equipment to a hard-over position in a single axis shall be 
such that with controls free for 3 sec following the disengagement or failure, the resulting rates 
of yaw, roll, and pitch shall not exceed 10° per sec and the change in normal acceleration shall 
not exceed ±0.5g.” Note that these requirements differ from the fixed-wing requirements 
only in the length of the time interval. For failures of a single power-operated control system, 
reference 10 retains the same limits, but states that the limits apply to trimmed level flight 
speeds above 80 knots. Reference 11 employs the same criteria for failures of the automatic 
stabilization equipment . As reference 1 explains, the criteria in reference 1 do not explicitly 
address 1) loss of control, 2) structural limit exceedence, or 3) collision with nearby objects. 
The proposed specification covers items 1 and 2 by stating that in forward flight the aircraft 
must stay within the Operational Flight Envelope and item 3 by the position excursions that 
result from the specified acceleration limits. Transient failure limits are also defined for both 
hover and low speed, while both references 10 and 11 cover only the forward flight portions 
of the aircraft flight envelope. 


EXPERIMENTAL DESIGN 


In this section, the current failure- recovery requirements are reviewed. Also, experimental 
variables along with the failure-insertion technique that uses the ADOCS control logic are 
described, and the failure recovery rating scale is introduced. 


Current Specification 


The proposed update to MIL-H-8501, Handling Qualities Specification for Military Ro- 
torcraft (ref. 1), states that “the transient following a failure or combination of failures shall 
be recoverable to a safe steady flight condition without exceptional piloting skill.” It also 
states that the perturbations encountered will not exceed the limits of table 1. As the ta- 
ble shows, the specification is broken into two speed regimes where hover and low speed 
are defined as speeds less than 45 knots. Near-earth operations are defined as operations 
sufficiently close to the ground or objects fixed on the ground such that flying is primarily 
accomplished with reference to outside objects. The levels 1, 2, and 3 boundaries are defined 
as Cooper-Harper ratings of 1-3.5, 3. 5-6. 5, and 6. 5-9. 5, respectively (ref. 4). 
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Figure 1, taken from the Background Information and Users Guide for reference 1, shows 
time histories of the attitudes, attitude rates, and body axes accelerations in addition to the 
explicit limits in 3 sec, as given in table 1. As shown, the attitude failures are assumed to 
produce a constant attitude rate, whereas the axial failures are assumed to produce linearly 
increasing body-axis accelerations. As mentioned earlier, the limits proposed in table 1 are 
hypothetical; the purpose of this experiment was to validate, or provide data to revise, these 
limits. 


Experimental Variables 

Experimental variables for this investigation were the failure axis, the magnitude of the 
failure, and the aircraft airspeed at the time of the failure. Other factors such as pilot 
workload, altitude, and terrain and obstacle proximity also play an important role in the 
pilot’s ability to recover from certain failures. The proposed requirements do not specify 
these conditions at the time of failure and, therefore, essentially similar conditions were 
maintained for all the simulated failures. This was possible since the pilots had to follow 
the strict mission scenario of the host simulation (to be discussed) which kept flight path, 
altitude, and terrain proximity similar for the mission task elements of all runs. 


Flight Control System and Failure Insertion 

A model-following control system, described in detail in reference 3, was used to examine 
the failure modes. The output of the model to be followed is fed into a structure that 
approximates a unity transmission via a simple premultiplied plant inversion in combination 
with a high-gain feedback stabilization loop for robustness and disturbance rejection. 

The FCS is divided into two parts (fig. 2): (1) a primary flight control system (PFC'S), 
and (2) an automatic flight control system (AFC’S). The PFC’S provides the pilot with a 
reversion mode that consists of simple forward-loop shaping of his command signals to the 
control actuators. The AFC’S contains the desired feed-forward command model along with 
the feedback laws that provide disturbance rejection as well as minimization of the effects 
of plant parameter variations. The output of the AFCS passes through some port limiting 
(fig. 3) and is then summed with the output of the PFC’S. The port limiting provides partial 
safeguard against hard-overs of the AFCS. Signals from the AFCS are divided between 
a high-frequency-compensation path and a low-frequency-trim followup path. The high- 
frequency path has a low-authority limit; thus any hard-over from the AFCS is attenuated 
by the combination of this low-authority limit and the rate limit in the low-frequency trim 
path. 

Block diagrams of PFCS in all four axes are shown in figure 4. Each axis, except for 
the directional axis, has a nonlinear shaping function, a sensitivity gain, and a derivative 
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rate limiter. All axes, except for the vertical axis, have a lead-lag shaping function. The 
outputs of these four control axes enter a control mixing network that attempts to decouple 
the aircraft response to control input. 

The aircraft responses to step inputs are shown in figures 5-8. These responses were 
generated using the stability derivative model of the 1JH-60 in hover (ref. 3) This model 
is shown again in figures 9 and 10. Concatenated in front of this model were the lead-lag 
shaping functions or gain (fig. 4). The input magnitude for each of the responses is the 
equivalent stick displacement in inches. 

For this investigation, failures were simulated by disconnecting the output of the AFC'S 
(prior to the port limiting) and replacing it with a step whose magnitude would determine 
the severity of the failure. As a result, the states that were fed back to the FCS computer no 
longer influenced the system response after the failure. The pilot was therefore required to 
recover the aircraft with only the PFCS in the failed axis which provided only forward-loop 
shaping of his commands. 


Failure Rating Scale 


The Cooper-Harper pilot rating scale is generally used to evaluate the handling qualities 
of aircraft, both in flight testing and in ground simulation. In this investigation, however, 
both handling qualities and the pilot’s ability to recover from a failure were of interest. It 
was felt that if the Cooper-Harper scale alone was used, the pilot would not be answering 
the questions that are directly relevant to failure recoveries. Also, certain keywords take on 
slightly different definitions in the context of a failure state. For example, workloads are 
typically very high while attempting to recover from a failure and as a result, “tolerable 
workloads” need to be redefined. Finally, even though the Cooper- Harper scale d^als with 
the question of flight safety, it is not explicitly broken down in the Cooper-Harper decision 
tree for the case of an ongoing failure. 

A new rating scale was therefore designed specifically for rating the ability to recover 
from the abrupt transient motion following a failure (fig. 11). The scale format is similar to 
a turbulence-effect rating scale discussed in reference 12. The design of this scale is similar 
to the Cooper-Harper scale in that certain key questions separate blocks of ratings. The 
first question in the decision tree serves simply to separate a crash from a recovery. The 
next question deals with safety of flight issues and separates those failures which endanger 
the aircraft and crew (level 3) from those that require appreciable effort for recovery but are 
not safety-critical (level 2). The final question in the tree quantifies the effort required to 
recover as noticeable (level 2) or negligible (level 1). Note that the failure rating scale uses 
letters instead of numbers to avoid confusion with the Cooper-Harper scale. This Failure 
Rating Scale was subsequently used to define and evaluate the monitoring concept for the 
NASA V/STOL Research Aircraft in reference 13. 
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As mentioned above, the failure rating scale was designed to complement the Cooper- 
Harper scale. Therefore, certain correlations between the two scales must be clearly defined. 
The failure rating scale consisted of three levels, defined similarly to the Cooper-Harper 
levels. For example, a failure rating level-1 (FRL 1 ) failure was considered to be a mild failure 
requiring only minimal increase in pilot workload. In the Cooper-Harper terminology, at most 
only mildly unpleasant deficiencies result from a FRL 1 failure and only minimal additional 
pilot compensation is required for desired performance. Note the relative nature of the failure 
rating scale as opposed to the absolute nature of the Cooper-Harper scale. Minimal pilot 
compensation in the failure rating scale refers to the pilot compensation required in addition 
to the pilot compensation required prior to the failure. Therefore, an aircraft having level- 
2 handling qualities (requiring considerable pilot compensation for adequate performance), 
may have a FRL 1 failure causing it to require minimal additional pilot compensation. Also 
note that the failure scale applies only to the interval of the transient motion following the 
failure. 

Since a combination of the severity of the failure and the handling qualities of the post- 
failure aircraft determine the ease of recovery, the rating scales are coupled. Therefore, to 
interpret each rating, the other rating must be known. Depending on the size of the failure, 
however, either the failure rating or the Cooper-Harper rating takes precedence. For a mild 
failure, the handling qualities of the post-failure aircraft determine the ease of recovery and 
therefore the Cooper-Harper rating is more informative. In the case of a severe failure, 
however, the failure rating takes precedence because a level-1 aircraft may crash just as 
easily as a level 2. 


INVESTIGATION FACILITIES 

The investigation was conducted as part of a simulation study of the effects of advanced 
flight control and display systems on the ability of a single pilot to perform various tactical 
military missions (ref. 2). A summary of the facilities used for the host simulation follows. 


Vertical Motion Simulator 

The six-degree-of- freedom, large- amplitude-motion Vertical Motion Simulator (VMS) was 
used for the evaluations. Figure 12 shows the VMS and its motion amplitude and rate limits. 
The large-motion capabilities of the VMS make it an ideal tool for failure simulations. It 
provides ample motion cueing to the pilots, allowing them to detect failures even while 
looking inside the cockpit . This ability adds a necessary degree of realism to the experiment , 
as indicated by the following postrun comment: 

As soon as I was sitting there very stable at a hover, suddenly I felt the vertical 
motion moving down. I looked up and saw the altitude dropping rapidly, grabbed 
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the collective and pulled, and I pulled very hard to get it to stop. (Pilot 3, Vertical 
level 1-2, Rating: F) 

The motion logic is set up such that translational accelerations and rotational rates from 
the aircraft’s model are input into filters whose effect is to wash out all translational and 
rotational displacements (up to constant acceleration inputs) (fig. 13). The motion gains 
and washout frequencies for this experiment are given in table 2. The gains and washout 
frequencies are the low speed constants below 30 knots, the high speed constants above 
60 knots, and a linear interpolation between the low and high speed constants for speeds 
between 30 and 60 knots. Note that all of the motion gains are less than unity. Thus the 
pilot feels only a percentage of the acceleration in the model. This may have a deleterious 
effect on cueing as discussed later. 


Advanced Cockpit 

The cockpit instrumentation was patterned after the displays currently used by the 
Army Advanced Rotorcraft. Technology Integration program. The flight controls were side- 
stick controllers for both cyclic and collective (Measurement Systems Incorporated limited- 
displacement force controllers) and limited-displacement pedals that were used for direc- 
tional control. The setup was similar to the ADOCS 2-1-1 configuration — a right-hand 
controller for pitch and roll and a left-hand controller for the vertical axis (ref. 3). The 
force/displacement gradients for the side sticks were all identical and equal to 1.82 lb/deg. 
The pedals had a force gradient of 40 lb/in with a breakout of 6 lbs. These gradients 
were selected from reference 3. Instead of the usual helicopter instrumentation, the pilot 
was provided with an instrument package consisting of two CRT displays (fig. 14). One of 
the displays was used as the mission-management display (MMD) to provide aiiv r aft and 
weapons status information (ref. 2). The other display served as the tactical-situation dis- 
play (TSD), a moving map display, to show the pilot his location and the locations of both 
enemy and friendly elements (ref. 2). Note that even though the MMD could have been used 
as a failure warning device, it was not used due to reasons discussed later. 


Head-Up Display 

In addition to the MMD and the TSD, a head-up display was used to portray flight-path- 
management information, such as altitude, airspeed, and heading, to the pilot. The head-up 
display operated in one of four selectable modes, namely hover, bob-up, transition, or cruise. 
Figures 15 and 16 show the Hover and the Cruise head-up displays, respectively. This HUD 
is based on the AH-64 Apache Helmet Mounted Display/Pilot Night Vision System display 
format. Almost all the failures were injected while the head-up display was in one of these 
two modes. 
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Evaluation Pilots 


A NASA research pilot flew several preliminary flights and then assisted in the develop- 
ment of the failure rating scale. Subsequently, five active-duty U.S. Army helicopter pilots 
participated in the experiment, two of whom flew the entire test matrix of the host sim- 
ulation. Although each Army pilot was a highly experienced helicopter pilot, all had only 
limited experience and training in research system evaluations and some had little experience 
with ground simulators. However, each pilot was given ample time to fly the simulator and 
familiarize himself with the system prior to evaluation flights. 


PROCEDURE 


The following sections describe the experimental task, the pilot briefing, and the data 
collection methods used. 


Task 


Since the failure transient experiment was conducted as part of a host simulation, the 
failures were inserted while the pilots were performing some portion of the task simulation 
for that scenario. The host simulation mission consisted of five distinct tasks: 1) ingress, 
2) air-to-ground engagement, 3) battle-damage assessment, 4) air-to-air engagement, and 5) 
egress. Failures were injected during the ingress, battle-damage assessment, and the egress 
phases only. However, the pilots were told that a failure could occur at anytime. 

The ingress phase involved nap-of-the-earth (NOE) flight at around 60 knots from a 
departure waypoint A to a waypoint B within the battle area. In addition to flying and 
navigating the aircraft, the pilot had the mission management tasks of providing the battle 
capt ain with st atus reports and enemy encounters or sightings. If fire was received, the pilot 
was to report the encounter and mark the position by pressing a button on the perimeter 
of the TSD. Upon reaching waypoint B, the air-to-ground engagement was initiated by 
directing the pilot towards an enemy tank positioned nearby. After the tank was destroyed, 
the battle-damage-assessment (BDA) phase was initiated. The pilot was instructed to move 
to a hover position close to the destroyed tank (which would be there regardless of who won 
the air-to-ground engagement) and conduct and transmit a BDA. The BDA information 
consisted of the responses to preprogrammed prompts which appeared on the MMD. While 
the aircraft was in hover, the BDA information had to be entered on the keyboard. All 
the vertical failures were inserted during this phase. Next, the pilot would be instructed to 
intercept and engage an enemy helicopter trying to penetrate the forward line of troops in 
his vicinity. No failures were inserted during this phase. The final portion of the mission 
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was egress and a return to base. This phase was frequently used to insert either low-speed 
NOE or high-speed up-and-away failures by altering the scenario to force the pilots to reach 
the required flight conditions. 

As mentioned previously, failures in each axis were created by replacing the corresponding 
AFCS signal with a predetermined, constant, step input. The magnitudes of the steps were 
chosen to create the desired attitude excursion in 3 sec (table 1) for each failure level, 
assuming that no recovery action was taken by the pilot. The pilots, however, were allowed 
to begin recovery as soon as a failure was detected. 

The basic task was to recover the aircraft to a safe flight condition. A safe flight condition 
was nominally defined as one that would allow a safe return to base. The ultimate definition 
of a safe flight condition, however, was left to the pilots, since it would depend on the 
situation. After the pilot had recovered and flown the degraded system long enough to be 
able to evaluate it, the simulation was stopped and the pilot was asked to give a failure 
rating for his ability to recover and also a Cooper-Harper rating for his ability to complete 
the combat mission with the degraded control system. 

Reference 1 states that “all crew members will be provided with immediate and easily 
interpretable indications that a failure has occurred and what corrective action is appropri- 
ate.” However, to avoid the question of how to best notify the pilot of a failure and the 
appropriate corrective action no means of failure indication were used for this experiment. 
Therefore, aside from the uncommanded motion of the aircraft, the pilots had no indication 
that a failure had actually occurred. 


Pilot Briefing 

In addition to the briefing to familiarize the pilots with the advanced cockpit and the 
complicated mission scenario of the host simulation, the pilots were given a briefing on the 
design, objective, and approach of the failure transient experiment. In particular, the pilots 
were introduced to the new failure rating scale and were briefed on how to make maximum 
use of it in conjunction with the Cooper-Harper scale. 


Data Collection 


All the relevant variables, including aircraft states, failure injection points, and pilot 
inputs were recorded on strip charts and magnetic tapes, the latter to allow subsequent 
computer-aided analyses. These analyses included the determination of pilot-response-time 
delay obtained by measuring the time between failure injection and first recovery action, 
using plots of control motion vs. time. Also, the entire postrun pilot commentary was 
recorded for each run, including the Cooper-Harper and the failure ratings. 
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RESULTS 


In reviewing the following results, it should be kept in mind that the post-failure handling 
qualities were dependent on the magnitude of the failure. Since the failure of the AFC'S causes 
some of the available control power to be used to trim out the failure, for large failures the 
resulting maneuvering control authority in one direction can be marginal. Pilot comments 
and ratings for all runs indicate that, for most of the runs, the pilots considered the post- 
failure aircraft (PFC'S in the failed axis only) to possess inadequate handling qualities for the 
task (completing the combat mission), based on Cooper-Harper ratings collected along with 
failure ratings (fig. 17). However, the controllability of the post-failure system was rarely in 
question. 


Longitudinal Axis 

The longitudinal failures were injected at three airspeeds: hover, 60 knots, and 100 knots. 
Of the five longitudinal failures injected at a hover, two were at the proposed maximum level- 
2 values and three at the level-3 values as presented in Table 1. Of the nine longitudinal 
failures injected at 60 knots, one was at level 2 and eight were at level 3. Finally, the failure 
injected at 100 knots was a level-3 failure. Figure 18 is a graphical compilation of the failure 
rating data in the longitudinal axis. 

For the uncommanded attitude excursions in a hover, the major problem seemed to be the 
tendency for a pilot-induced-oscillation (PIO) initially following the failure, as the following 
comments indicate: 

Ok, was recovery impossible? Almost., but “No” it wasn’t. Was safety of flight 
compromised during recovery? “No”, marginally. Was a significant amount of 
effort required to recover? Definitely “Yes”. It was noticeable. I will give it an 
“E”, poor. Too many PIOs. Even me relaxing on it and everything else. (Pilot 
2, Longitudinal level 2, Rating: E) 

This tendency can be attributed partially to the degraded handling qualities of the simulated 
ADOCS PFC'S as compared to the AFCS. In any case, level-3 failures (24° attitude change 
in 3 sec) seemed too large to be countered effectively in a precise hover- hold situation, e.g., 
hovering in a masked position, and were mostly rated FRL 3. The specified values from 
reference 1 seem quite acceptable for hover, as may be seen from figure 18. Note that almost 
all the hover ratings fall within the boundaries of the same magnitude and rating levels. 

The results were not as clear for the forward flight (60 and 100 knots) cases. Again, 
the major difficulty seemed to be PIOs following the attempt to correct the initial attitude 
excursion. Pilots commented that in an NOE environment, this tendency to cause a PIO in 
pitch can very well be fatal. 
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I would say it was very poor and give it a rating of “Foxtrot.” Specifically, for 
the purpose of the fact that we’re flying low level and NOE in the close proximity 
of trees and obstacles in route, and I can’t stand those pitch oscillations of 15 to 
20 to 30 degrees uncommanded, especially, when I’ve got my attention diverted 
to other things like handling the MMD, trying to plug in coordinates, and trying 
to talk on the radio all at the same time. (Pilot 2, Longitudinal level 3, Rating: 

F) 

The results were also inconsistent from pilot to pilot, as shown in figure 18. One of the 
pilots consistently rated all failures in all axes to be unrecoverable. Another pilot, on the 
other hand, rated the same level-3 failure from “B” (very good, negligible amount of effort 
required to recover, FRL 1) to “E” (poor, noticeable amount of effort required to recover, 
FRL 2). 

A look at pilot-response time delay (defined as the interval between failure insertion and 
the first major control input in the corresponding axis) for some of the longitudinal failure 
cases (fig. 19) did not help explain this spread. However, it was noticed that the response 
times for the milder failures were somewhat longer. Interestingly, it was also noted that 
failures at a hover seemed to take longer to detect. 

In summary, the data suggest that the specifications may be satisfactory for the hover 
case, whereas the specifications for the forward flight case cannot be conclusively validated 
or rejected. 


Lateral Axis 

Preliminary evaluations suggested that the proposed level-1 lateral failures were exceed- 
ingly mild and therefore, only values based on the maximum level 2, level 3, and more severe 
failures in both hover and forward flight (60 knots) were evaluated. Figure 20 is a graphical 
presentation of the data. 

For the lateral-axis failures in a hover, the major problem seemed again to be the PlOs 
as a result of initial overcontrol. 

It took me four or five overshoots, probably pilot induced oscillations, to get it 
down to some kind of controllable level. I almost flew into the mountain on my 
right. If I had been in a tight hover hold when that happened, it would have 
been all over, because I would have immediately went right into the trees, and 
I wouldn’t have been able to react fast enough to save the aircraft. (Pilot 3, 
Lateral level 3, Rating: G) 

The extent of overcontrol seemed to be directly related to the mission-management task 
being performed at the moment of failure insertion. Pilots commented that the motion 
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system sufficiently enabled them to detect uncommanded motion of the aircraft even while 
looking inside the cockpit. 

I was looking down and I’m going “whoa, something is going wrong” and I looked 
up and there 1 was at a 30° bank. (Pilot 2, Lateral level 3, Rating: H) 

However, some complained that the lack of detail in the computer-generated imagery often 
caused them to judge their initial attitude incorrectly. 

As seen from figure 20, the hover data points fall either within or just outside the bound- 
aries of the same magnitude and rated levels. The “H” rating given by pilot 2 for the level-3 
failure in a hover may be explained based on his pilot-response-time delay. Because he was 
preoccupied with reporting his location during the simulated mission, he failed to detect the 
failure for almost 5 sec then, apparently surprised by the attitude excursion, he drove the 
aircraft too hard, causing an unacceptable PIO. His comments indicate that the PIO caused 
him to rate the failure unrecoverable. 

I reached over on the map, and I was looking down at it when I started noticing 
the failure. 1 let go of the map. I tried to recover, and it was just one PIO to 
the other laterally, and there’s no way for me to recover. (Pilot 2, Lateral level 
3, Rating: H) 

For the forward-flight case, the data suggest that the current specifications are restrictive. 
As figure 20 shows, almost all data points fall to the right of the boundaries of the same 
magnitude and rating levels. Note that failures more severe than the specified level 3 of 24° 
in 3 sec were used to determine when FRL 2 and FRL 3 failures are actually reached. A 
possible revision of the specifications for the forward-flight lateral failures is suggested by 
figure 21. The new boundaries are constructed by defining the specified level 3 to be the new 
level 1 and the next two (more severe) levels to be the new levels 2 (32° in 3 sec) and 3 (70° 
in 3 sec) respectively. As may be seen, a majority of the forward-flight points fall within the 
appropriate new boundaries. 

A partial plot of failure rating vs. pilot-response-time delay may be used to explain 
some of the inconsistencies. For example, pilot 5 rated the same new level-2 failure both a 
“B” (very good, negligible amount of effort, required to recover, FRL 1) and an “E” (poor, 
noticeable amount of effort required to recover, FRL 2). Figure 22 shows that for the failure 
rated a “B”, pilot 5 responded in approximately 0.25 sec whereas for the one rated an “E”, 
the response time was approximately 0.75 sec. From figures 23 and 24, it can be seen that 
the additional time resulted in an attitude excursion which was three times as large at the 
end of the 0.75-sec delay compared to the 0.25-sec delay. The difference of 6° may not seem 
significant by itself, but the ensuing PIO resulted in a maximum attitude change of 39° for 
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the longer detection period compared to 19° for the shorter one. This difference is quite 
significant and probably caused the difference in ratings. 

A difference in average response time between failures in pitch and roll was observed. A 
comparison of figures 19 and 22 reveals that the roll failures were, on the average, detected 
sooner than pitch failures of comparable severity. A possible reason for this may be the 
means by which the pilots detect errors in pitch and roll in the simulator (and possibly the 
real world). A horizon line that is not level, whether detected from the computer-generated 
image or from an instrument with an artificial horizon, is a quick indicator of an attitude 
error in roll for level flight. Errors in pitch must be detected from biases of the entire horizon; 
thus they may be harder to detect. 

In summary, the current specifications seem to be adequate for failures in a hover. How- 
ever, revision of the forward flight specifications may be warranted. 


Directional Axis 

The results for failures in the directional axis were inconclusive, as shown by figure 25. 
Pilot 1 again considered the only failure he was given (level 3) to be unrecoverable, whereas 
the data for the other pilots were scattered. Pilot 2 generally rated similar failures easier to 
recover from than pilot 3. Both, however, rated identical failures very differently at different 
times. 

Nevertheless, the data indicate that the directional-axis failure specifications are too 
rest rictive. Since all the data points fall to the right of the boundaries of the same magnitude 
and rating levels in figure 25. Note that, because recovery from the specified level-3 failures 
is considered easy a new, more severe, failure level was also examined. The spread j” the 
data makes it impossible to suggest a new set of specifications, as given for the lateral axis. 

A plot of failure rating vs. pilot-response-time delay was made as an attempt to explain 
some of the scatter. As may be seen from figure 26, a few of the inconsistencies may be 
explained. For example, pilot 3 rated the new level-2 failure once a “C” (good, noticeable 
amount of effort required to recover, FRL 2) and another time an “F” (very poor, safety 
of flight compromised during the recovery, FRL 3). Considering the severity of the failure, 
the slight difference (increase) in response delay may explain the worse rating. Even using 
pilot-response-time delay to explain some of the spread, the data remain too scattered to 
point to any definite conclusions. 


Vertical Axis 


The severity of vertical axis failures was measured based on the resulting vertical accel- 
eration. As may be seen from table 1, the specifications define incremental accelerations of 
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0.05, 0.2, and 0.4 gs within 3 sec as level-1, level-2, and level-3 failures, respectively. All 
three levels were examined in a hover only, as shown in figure 27. 

A majority of the vertical failures of all levels, except specification level 1, were rated as 
impossible recoveries (fig. 27), caused mainly by the inability of the pilots to detect sinking 
motion of the aircraft. This inability seemed to refer mainly to cases where the pilots 
were looking inside the cockpit while performing a mission management task. However, 
even when looking outside the cockpit, the computer-generated imagery seemed to afford 
sufficient cueing of the downward motion only when very close to the ground. Additionally, 
pilot comments indicated (1) a failure detection and warning system was needed to aid them 
in initiating recovery as soon as possible and (2) the need to release the collective side-stick 
cont roller to free a hand for mission management tasks had an appreciable effect on recovery. 

In a normal situation in flight, single-pilot cockpit, I’m going to have to use one of 
my hands. I can’t use the cyclic because of the sensitivity of it, so I am having to 
release my collective. That’s causing me to not monitor 100% on that collective. 

It is, on a single-pilot-cockpit. type environment, it is impossible to expect the 
pilot to have to maintain hands on the control 100% of the time. (Pilot 2, Vertical 
level 3, Rating: H) 


Almost all of the failures which occurred while the pilot was performing a mission- 
management task involving the use of his left hand were rated unrecoverable. 

Additional levels were defined between levels 1 and 2 to further explore the acceleration 
at which the change from recoverable to unrecoverable occurs. As figure 27 shows, almost 
all failures at or above the new level 1.6 (with a maximum acceleration of O.llgs) were 
considered unrecoverable. Since only a few runs were done with smaller accelerations, the 
accelerations corresponding to FRL 2 and FRL 3 cannot be determined. The data, however, 
suggest that the current failure specifications are too lenient for a NOE environment. The 
specified accelerations for each level need to be reduced. The magnitude of the reduction, 
however, cannot be determined because of insufficient data. 


DISCUSSION OF RESULTS 


A general observation for all the runs was that the existence of direct failure-warning 
instrumentation in the cockpit would have had an appreciable effect on the recovery. This 
is especially true for the less severe level 1 and 2 failures, which were at times detected very 
late or not at all. 

(You had a collective failure) I did? (Yes) If I did, I didn’t notice it. (Pilot 2, 
Vertical level 2, Rating: A) 
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Another possible reason for the inability to detect the less severe failures may be due to the 
motion feedback to the pilot. Although the visual scene integrates the model acceleration 
correctly and gives the pilot the full effect of the failure, the motion system first, attenuates 
the magnit ude of the failure by the motion gain and then washes it out to zero. The latter 
effect should go unnoticed by the pilot, but the former effect directly reduces the acceleration 
cue to the pilot by 30%. These effects lead to conservative results since, in the actual aircraft , 
the pilot will have better motion feedback cues. Since the visual cues in the real world also 
will be better, they lead to conservative simulation results. 

Some of the pilot s expressed a need for a device that would inform them of exactly what 
had failed and which systems were affected. 

I would rather have some more aircraft systems telling me that that’s what I 
have. In other words, if I have a longitudinal axis failure on my flight control 
system, I would like to have a light that says it or something comes on saying, 

“hey, you have a failure” .. .1 was in question whether it was me flying bad or 
the aircraft having a failure. I really wasn’t sure. (Pilot. 2, Longitudinal level 2, 
Rating: C) 

Such a device can be especially useful for the milder failures. In fact, an argument may be 
made that in the absence of failure- warning instrumentation, mild failures may be dangerous 
since they may go undetected until a recovery is impossible, especially in higli-workload 
situations. 


I had my attention outside, trying to make a radio call, thinking about a battle 
damage assessment, looking for the enemy, and thinking about programming in 
the report. With all of these other things on my mind, I don’t have time to be 
monitoring the flying that close, and I don’t think I would have caught it in time, 
so I’m going to give it an “H”. (Pilot 3, Vertical level 2, Rating: H) 


Therefore, a high fidelity monitoring system can be crucial in dealing with the milder failures. 

Some general comments follow. 1) For hover and low speed, the attitude excursion 
specifications do not distinguish between failures based on how and when (within the 3- 
sec period) the maximum attitude is reached. Such distinctions may be important.. For 
example, a failure which causes a large initial attitude change which levels off as the maximum 
excursion is reached, may be more severe than one with a slow initial attitude change on the 
way to the same maximum value. This is true especially in the presence of failure warning 
systems that would allow the pilot to become aware of the latter type of failures before the 
attitude change becomes too large. Therefore, additional attitude-rate specifications may be 
desirable to further clarify severity levels. 
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2) Similarly, for translational accelerations, the manner in which the maximum accel- 
eration for each level is reached is not clearly specified. From the figures provided in the 
Background Information and Users Guide to MIL-H-8501, it appears that a linear increase 
in acceleration has been used to define corresponding rates and displacements. Linearly- 
increasing axial accelerations may be physically unrealistic. For hover and low-speed flight, 
a hard-over in the vertical axis will produce a step in acceleration that becomes washed out 
as the vertical velocity increases. In fact, it is difficult to see what type of failure in the 
vertical axis would cause a linear increase in acceleration for hover and low-speed flight. It 
seems more reasonable to change the proposed specification to reflect step time-histories in 
the vertical axis rather than ramps. Step accelerations are also desirable because they result 
in the maximum possible rates and displacements. 

3) The same situation exists for the forward flight case. It is assumed that the accelera- 
tions increase linearly to the maximum allowable in the specified interval of time depending 
on the level. Again, a step increase in acceleration may be more appropriate. Current specifi- 
cations do not distinguish between such failures (a step as opposed to a ramp) as long as they 
do not exceed the maximum specified acceleration. The resulting rates and displacements 
are sufficiently different, however, to warrant new definitions of the levels. 

4) Finally, an important area that the new specification does not cover is a discussion 
of the regulation of the unfailed axes during recovery. With a hingeless rotor system, the 
recovery from the failed axis may introduce off-axis rates that must also be regulated. Thus 
the degree of augmentation left in the unfailed axes may influence the pilot ’s ability to recover 
from the failure. 


CONCLUSION 


A moving-base simulation was performed to determine if the transient failure require- 
ments suggested in the proposed handling qualities requirements for military rotorcraft are 
satisfactory. The simulation used the ADOCS control law structure with a 2-1-1 side-stick 
controller mechanization which used two side sticks, one for pitch and roll and the other for 
collective, and pedals for yaw. Failures were simulated as hard-over failures of the automatic 
flight-control system in both hover and forward flight. The failures were given to the pilot 
while under high workload during a simulated mission scenario. No failure warnings were 
presented to the pilot. Also, the failure mechanization forced the pilot to recover the aircraft 
with no feedback stabilization in the failed axis. Finally, a failure rating scale was developed 
to enable the pilot to rate the recovery from the failures accurately. 

Results indicate that the proposed criteria for the longitudinal and lateral axes in hover 
are reasonable while the criteria for the vertical axis appear to be too lenient . The directional 
axis results were inconclusive in hover. For forward flight, the longitudinal-axis results 
are inconclusive, while the lateral-axis results suggest, that the proposed criteria are too 
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restrictive, and possible new criteria are defined. Directional-axis forward flight results are 
also inconclusive. 
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TABLE 1. — Transients due to failures 


LEVEL 

FLIGHT CONDITION 

HOVER AND LOW 
SPEED 

FORWARD FLIGHT 

NEAR EARTH 

UP-AND-AWAY 

1 

3-deg ROLL, PITCH, YAW 
0.05g n x n y n z . NO 
RECOVERY ACTION 
FOR 3.0 sec 

BOTH HOVER-AND-LOW-SPEED 
AND FORWARD-FLIGHT UP 
AND AWAY REQTS APPLY 

STAY WITHIN THE 
OFE. NO RECOVERY 
ACTION FOR 10 sec 

2 

10-deg ATTITUDE 
CHANGE OR 0.2g 
ACCELERATION. 
NO RECOVERY 
ACTION FOR 3.0 sec 

BOTH HOVER-AND-LOW SPEED 
AND FORWARD-FLIGHT UP 
AND AWAY REQTS APPLY 

STAY WITHIN OFE. 
NO RECOVERY 
ACTION FOR 5.0 sec 

3 

24-deg ATTITUDE 
CHANGE OR 0.4g 
ACCELERATION. 

NO RECOVERY 
ACTION FOR 3.0 sec j 

BOTH HOVER-AND-LOW-SPEED 
AND FORWARD-FLIGHT 
UP AND AWAY REQTS 

STAY WITHIN OFE. 
NO RECOVERY 
ACTION FOR 3.0 sec 


OFE: OPERATIONAL FLIGHT ENVELOPE 


TABLE 2 — Motion logic gains and frequencies 

Low speed 3 * High speed* 5 


GP 

Roll gain 

0.3 

0.2 

GQ 

Pitch gain 

0.3 

0.2 

GR 

Yaw gain 

0.3 

0.2 

GX 

Longitudinal gain 

0.6 

0.3 

GY 

Lateral gain 

0.4 

0.3 

GZ 

Vertical gain 

0.7 

0.3 

Wp 

Roll washout frequency, rad/sec 

0.6 

0.7 

«q 

Pitch washout frequency, rad/sec 

0.5 

0.6 

co r 

Yaw washout frequency, rad/sec 

0.5 

0.6 


Longitudinal washout frequency, rad/sec 

0.7 

1.0 

COy 

Lateral washout frequency, rad/sec 

0.5 

0.7 

«z 

Vertical washout frequency, rad/sec 

0.3 

1.0 


3 Low speed <30 knots 

b High speed >60 knots 
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X, X, X (ft, sec); 0 , 6 , 6 (deg, sec) 



i x , n y , n z , (TABLE 1) 
n x , n y , n z , (LEVEL 3) 

(TABLE 1) 
9 . 4 . 4 . (LEVEL 2) 

n x , n y , n z , (LEVEL 2) 


TIME, sec 
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Figure 2. — ADOCS flight-control system concept. 
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Figure 3. — AFCS-PFCS interface limiter. 
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Figure 4. — PFCS block diagram. 
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Figure 6. — Response to an equivalent 1-in. collective input. 
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Figure 7. — Response to an equivalent 1-in. lateral cyclic input. 
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Figure 8. — Response to an equivalent 1-in. pedal input. 
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Figure 9. — UH-60 hover longitudinal equations of motion. 
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Figure 10. — UH-60 hover lateral-directional equations of motion. 
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AMOUNT OF 
EFFORT 


ABILITY TO 
RECOVER 


RATING 



SAFE OPERATING CONDITION = WITHIN BOTH AIRCRAFT AND OPERATIONAL LIMITS 

RECOVERY = RETURN TO SAFE OPERATING CONDITION 

EFFORT = INTEGRATED PHYSICAL AND MENTAL WORKLOAD REQUIRED TO 
EXECUTE RECOVERY 

COMPROMISE SAFETY OF FLIGHT = CAUSE TO EXCEED EITHER AIRCRAFT OR 

OPERATIONAL LIMITS OR CAUSE AN 
ENCOUNTER WITH SURFACE OBSTACLES 


Figure 11. — Failure rating scale. 
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Figure 12. — Vertical motion simulator. 
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Figure 13. — Motion logic diagram. 
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Figure 15. — Hover head-up display. 



Figure 16. — Cruise head-up display. 
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Figure 18. — Longitudinal axis failures. 
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Figure 19. — Reaction time delays for longitudinal axis failures. 
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Figure 20. — Lateral axis failures. 
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Figure 21. — Suggested revision for lateral axis failures. 
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Figure 22. — Reaction time delays for lateral axis failures. 



Figure 23. — Time history for new level 2 roll-axis failure. 
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Figure 25. — Direction axis failures. 
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Figure 26 . — Reaction time delays for directional axis failures. 
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Figure 27. — Vertical axis failures. 
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